Rename discriminator to waf everywhere (closes #312)

The command is now `sww waf`, and the package is `internal/waf`. Types,
functions, files, tests, comments, docs, the Dockerfile, the runit
script, `script/`, compose examples, the log field `waf_line` and the
`X-From-Waf` test header follow. No behaviour changes, and no setting
changes name: rproxy already finds the waf through `SWRP_WAF_BACKEND`.

Done with one `sed -i` (Discriminator and DISCRIMINATOR to WAF,
discriminator to waf) over the files `git grep -i discriminator`
listed, as sneak allowed for this rename, then `git mv` for the
package and files. By hand afterwards: the header's spelling, which
the linter requires, and the padding after `waf` in `sww`'s usage
text.

Model: opus-5-5

Dockerfile

@@ -155,7 +155,7 @@ RUN git checkout --quiet --detach b4b2c785308b1ce785b6155c7fe5f16879080193 \
         -o /usr/local/bin/runsvinit .
 
 # The image, described under "Deployment" in SPEC.md. It runs rproxy unless
-# SWW_COMMAND says discriminator, and an app's Dockerfile can build FROM it.
+# SWW_COMMAND says waf, and an app's Dockerfile can build FROM it.
 # It is the last stage, so a plain `docker build .` builds it.
 #
 # ubuntu 26.04, 2026-09-27
@@ -223,7 +223,7 @@ RUN groupadd --system --gid 65532 sww \
 
 # The state files' directory, SWW_STATE_DIR by default, where a volume
 # is mounted to keep them across deploys. The run script gives it to the
-# sww user at each start of discriminator.
+# sww user at each start of waf.
 RUN mkdir /var/lib/sww
 
 # The default rule file, in SWW_RULES_DIR by default, where a Dockerfile